Description

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-21T07:16:53.463Z",
  "pubdate": "2026-09-21T07:16:53.463Z",
  "executiveSummary": "The Canva Mobile App for HarmonyOS prior to v1.15.1 contains a vulnerability involving improper restriction of HTTP headers within a privileged WebView component. This flaw allows an external origin to access sensitive information by intercepting headers returned to the WebView.\nThe vulnerability type is classified as an improper restriction of communication channels, which leads to potential session hijacking or sensitive data exposure. The impact is significant as it permits an attacker who controls the content or redirects the WebView to exfiltrate session-related tokens or authentication artifacts.\nAffected systems are limited to the Canva Mobile App for HarmonyOS versions preceding v1.15.1. The risk implication is high, as session compromise can lead to unauthorized account access and potential data exfiltration from the user's Canva workspace. Exploitation requires the threat actor to have control over the environment or origin served within the privileged WebView, enabling them to bypass standard security boundaries enforced by the mobile application framework.",
  "technicalDetails": "The vulnerability resides in the configuration of the WebView component used within the Canva Mobile App for HarmonyOS. In this context, the application failed to implement robust cross-origin resource sharing (CORS) policies or proper WebView security settings that restrict access to sensitive HTTP response headers.\nSpecifically, the WebView is initialized with privileged access, allowing it to interact with local app resources or session-scoped authentication tokens. When the WebView loads content from an external origin, the lack of header filtering ensures that sensitive headers, which may include session identifiers or authentication tokens, are inadvertently exposed to the external origin or scripts executing within that domain.\nThe attack flow follows these steps: First, an attacker must gain control over an origin rendered within the application's WebView. This could be achieved via a compromised URL, a man-in-the-middle (MITM) scenario where traffic is intercepted, or by manipulating the WebView to navigate to a malicious destination. Once the malicious origin is loaded, the attacker's script executes within the context of the WebView. Because the application fails to restrict headers returned to external origins, the script can programmatically access the headers of the responses loaded by the WebView.\nBy inspecting these headers, the attacker can extract session-specific tokens, cookies, or other authentication metadata that the app includes in its requests. Once these tokens are exfiltrated to the attacker-controlled server, the threat actor can reconstruct the user's session, effectively bypassing standard authentication mechanisms. This post-exploitation impact grants the attacker the same level of access as the legitimate user, allowing for data manipulation, account information extraction, or unauthorized content modification within the Canva ecosystem.\nThe root cause is an over-privileged WebView configuration that permits the leakage of sensitive data across origin boundaries, violating the fundamental principle of isolation between privileged application code and un-trusted external web content."
}